WCAGAAA
How to test criterion 3.3.9 “Accessible Authentication (Enhanced) — A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:”
- WCAG references
- 3.3.9 Accessible Authentication (Enhanced) (AAA)
What this criterion says
A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:
- Alternative
- Another authentication method that does not rely on a cognitive function test.
- Mechanism
- A mechanism is available to assist the user in completing the cognitive function test.
Official methodology to test criterion 3.3.9
Official W3C techniques
The W3C does not publish a test procedure for this criterion. It publishes techniques instead: documented ways to meet it, and the failures that do not.
Sufficient techniques
- G218 Email link authentication
- H100 Providing properly marked up email and password inputs
Providing WebAuthn as an alternative to username/password (Potential future technique)
Providing a third-party login using OAuth (Potential future technique)
Using two techniques to provide two-factor authentication (Potential future technique)